Drop a project folder here
Or click to choose one. Scanning happens entirely on your device — nothing is sent anywhere, ever.
Works best in Chrome/Edge. Very large projects (thousands of files) may take a moment.
Ignored findings (this scan)
Findings you've ignored during this scan, with their original masking restored in the working copy above. Restoring re-masks the value, removes it from this device's local ignore list, and brings it back into the results above.
Nothing ignored yet.
Scan history
Stored locally in this one browser, on this one device, only. It never syncs anywhere and is lost if you clear this site's browser data. The same applies to any finding you ignore: only a one-way hash of the value is kept — never the value itself — so a changed value always reappears, flagged, rather than staying silently hidden.
No scans yet.
Rule editor
Edits here apply only to scans in this browser, layered on top of the shared detection rules — they never modify the underlying rule set itself, and other visitors (or your own other devices) are never affected. Stored locally, same as scan history above.
Key patterns
Placeholder allow-list
Values that look like secrets but aren't (matched whole, case-insensitive) — anything here is never flagged even if it would otherwise look suspicious.
Known limitations
- No git-diff/changed-files scanning here — every scan is a full pass over whatever folder you give it. (The downloadable desktop app has a git changed-files mode.)
- An unquoted YAML value's mask isn't force-quoted the way the desktop app does it. A bare
*is YAML's alias syntax, so redacting an unquoted YAML scalar can, in rare cases, produce invalid YAML. - Scan history, the ignore list, and any rule edits are stored only in this one browser, on this one device — nothing syncs across browsers or devices, and it's lost if you clear this site's browser data.
- Sanitizing is a deliberate multi-step flow: filter which files to scan → review/ignore findings (and "Scan again" to refresh, if needed) → "Generate sanitized file" → "Download" appears for that specific generated copy. Changing anything afterward — an ignore, a restore, or another scan — marks that generated copy stale and requires regenerating before you can download.
- "Scan again" re-reads the folder fresh from disk only when it was opened via "Remember a folder for next time" (Chrome/Edge's File System Access API). For a folder provided by drag-and-drop or "Choose folder," there's no way to silently re-read it, so "Scan again" re-scans the same in-memory copy — edits made on disk since then won't be reflected until you choose the folder again.